Rocky Linux 9.6 [TuxCare] 安全性更新：kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc 多個漏洞 （ALMALINUX9.6：CLSA-2026：1792445930）
high Nessus Plugin ID 369491
語言:
概要
Rocky Linux 主機缺少一個或多個安全性更新。說明
Rocky Linux 9.6 主機已安裝的套件會受到 TuxCare ALMALINUX9.6：CLSA-2026：1792445930 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE(). (CVE-2024-57793)
- 已解決 Linux 核心中的下列弱點：crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true:
https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false later, an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by uninitialized data. (CVE-2025-71113)
- 已解決 Linux 核心中的下列弱點：rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example (CVE-2026-31630)
- 已解決 Linux 核心中的下列弱點：netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)
- 已解決 Linux 核心中的下列弱點：drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 ALMALINUX9.6：CLSA-2026：1792445930 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 369491
檔案名稱: tuxcare_rocky_linux_9.6_CLSA-2026-1792445930.nasl
版本: 1.1
類型: Local
已發布: 2026/10/21
已更新: 2026/10/21
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: High
分數: 8
百分位數: 99.69
Vendor
Vendor Severity: Important
CVSS v2
風險因素: Medium
基本分數: 6.8
時間性分數: 5.3
媒介: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2026-64424
CVSS v3
風險因素: High
基本分數: 7.8
時間性分數: 7
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:P/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2026/10/19
弱點發布日期: 2025/1/11
參考資訊
CVE: CVE-2024-57793, CVE-2025-71113, CVE-2026-31630, CVE-2026-45873, CVE-2026-53138, CVE-2026-53224, CVE-2026-53246, CVE-2026-53268, CVE-2026-53294, CVE-2026-53374, CVE-2026-53388, CVE-2026-53399, CVE-2026-63808, CVE-2026-63823, CVE-2026-63888, CVE-2026-63922, CVE-2026-63945, CVE-2026-63970, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-63996, CVE-2026-64009, CVE-2026-64017, CVE-2026-64029, CVE-2026-64098, CVE-2026-64109, CVE-2026-64113, CVE-2026-64114, CVE-2026-64342, CVE-2026-64354, CVE-2026-64362, CVE-2026-64424, CVE-2026-64470, CVE-2026-64471, CVE-2026-64546, CVE-2026-64548, CVE-2026-64555, CVE-2026-64560, CVE-2026-68266, CVE-2026-68411, CVE-2026-72299, CVE-2026-72383, CVE-2026-72398, CVE-2026-72404, CVE-2026-74268, CVE-2026-74345, CVE-2026-74359, CVE-2026-74450, CVE-2026-74479, CVE-2026-74550, CVE-2026-74575, CVE-2026-74637, CVE-2026-74714, CVE-2026-80725, CVE-2026-80840, CVE-2026-80841, CVE-2026-80951, CVE-2026-80976, CVE-2026-89476, CVE-2026-89488, CVE-2026-89520, CVE-2026-89545, CVE-2026-89564, CVE-2026-89625, CVE-2026-89633, CVE-2026-89637, CVE-2026-89659, CVE-2026-89685, CVE-2026-89763, CVE-2026-89778, CVE-2026-89972, CVE-2026-90041, CVE-2026-90111, CVE-2026-90116, CVE-2026-90292, CVE-2026-92508, CVE-2026-93117, CVE-2026-97531, CVE-2026-97541, CVE-2026-97555, CVE-2026-97918, CVE-2026-97931, CVE-2026-97935, CVE-2026-97938, CVE-2026-97949, CVE-2026-98248, CVE-2026-98260, CVE-2026-98312, CVE-2026-98354, CVE-2026-98365, CVE-2026-99999
CLSA: 2026:1792445930